diff options
| author | Glenn Strauss <gstrauss@gluelogic.com> | 2021-10-15 15:57:31 -0400 |
|---|---|---|
| committer | Glenn Strauss <gstrauss@gluelogic.com> | 2021-10-16 01:57:50 -0400 |
| commit | b1d1202af8217d3565b862289e1f3d50a633452b (patch) | |
| tree | 1cb44bd86821c9880ea6c616a2efc92e9d842074 /src/mod_auth.c | |
| parent | f5b5537ef16463ad357030f1e281b3a478bab614 (diff) | |
| download | lighttpd-git-b1d1202af8217d3565b862289e1f3d50a633452b.tar.gz | |
[mod_auth] fix Basic auth passwd cache (fixes #3112)
(thx manfred)
Basic auth passwd cache might fail to match when it should have
matched (false negative) when comparing an uninitialized byte.
That bug "fails closed" and does not use the cache when it could.
This patch allows for proper match in the cache when it should match.
x-ref:
https://redmine.lighttpd.net/issues/3112
"mod_auth cache password doesn't match"
Diffstat (limited to 'src/mod_auth.c')
| -rw-r--r-- | src/mod_auth.c | 3 |
1 files changed, 2 insertions, 1 deletions
diff --git a/src/mod_auth.c b/src/mod_auth.c index c0beb355..6fb7cd7c 100644 --- a/src/mod_auth.c +++ b/src/mod_auth.c @@ -63,7 +63,7 @@ http_auth_cache_entry_init (const struct http_auth_require_t * const require, co *(store pointer to http_auth_require_t, which is persistent * and will be different for each realm + permissions combo)*/ http_auth_cache_entry * const ae = - malloc(sizeof(http_auth_cache_entry) + ulen + pwlen); + malloc(sizeof(http_auth_cache_entry) + ulen + pwlen+1); force_assert(ae); ae->require = require; ae->ctime = log_monotonic_secs; @@ -74,6 +74,7 @@ http_auth_cache_entry_init (const struct http_auth_require_t * const require, co ae->pwdigest = ae->username + ulen; memcpy(ae->username, username, ulen); memcpy(ae->pwdigest, pw, pwlen); + ae->pwdigest[pwlen] = '\0'; return ae; } |